In conventional elevator installations electromechanical switches are employed for bridging over the door contacts. Particularly in the case of elevator installations in office buildings, however, the number of journeys of the elevator car can be more than 1,000 per working day, in which case bridging-over of the door contacts takes place twice in each journey. Thus, a number of approximately 520,000 switchings per year results for the electromechanical switches. This number is so high that the electromechanical switches become the principal limiting factor for the reliability of the bridging-over of the door contacts.
Due to the high number of switching actions and the high demands the bridging-over of the door contacts is classified as a so-called high-demand safety function. In general, the Standard IEC 61508 defines high-demand safety functions as functions which in disturbance-free normal operation of the elevator installation switch on average more than once per year, whereas by low-demand safety functions there are designated such functions which are provided only for emergency situations of the elevator installation or only for an emergency operation of the elevator installation, in which a disturbance is present and on average switch less frequently than once per year.
A significant element of this International Standard IEC 61508 is the determination of the safety requirement stage (Safety Integrity Level—SIL; there are SIL1 to SIL4). This is a measure for the necessary or achieved risk-reducing effectiveness of the safety functions, wherein SIL1 has the lowest demands. Provided as essential parameter for the reliability of the safety function of apparatus or installations are the calculation bases for PFH (probability of dangerous failure per hour) and PFD (probability of dangerous failure on demand). The first parameter PFH relates to high-demand systems, thus to those with a high demand rate, and the second parameter PFD to low-demand systems, the time of their service life being virtually equal to non-actuation. The SIL can be read off from these parameters.
A further definition, which can be found in technical media on the basis of this Standard (IEC 61508-4, section 3.5.12), of the low-demand mode of operation (Low-Demand Mode) and the high-demand mode of operation (High-Demand Mode or continuous operating mode) specifies the distinction thereof not on the basis of the low or high (continuous) demand rate, but in the following terms: A (low-demand) safety function, which operates in demand mode, is executed only on demand and brings the system to be monitored into a defined safe state. The executive elements of this low-demand safety function have no influence on the system to be monitored prior to occurrence of a demand for the safety function. Thereagainst, a (high-demand) safety function operating in continuous mode, always keeps the system, which is to be monitored, in its normal safe state. The elements of this high-demand safety function thus constantly monitor the system to be monitored. Failure of the elements of this (high-demand) safety function has the direct consequence of a risk if no further safety-related systems or external measures for risk reduction are effective. Moreover, a low-demand safety function is present when the demand rate is not more than once per year and not greater than twice the frequency of the routine inspection. A high-demand safety function or continuous safety function is, thereagainst, present when the demand rate is more than once per year or greater than twice the frequency of the routine inspection (see also IEC 61508-4, section 3.5.12).